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DETAILED ACTION 

EXAMINER'S AMENDMENT 

1 . An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Christine McCarthy on 2/27/2008. 

The application has been amended as follows. 

In the claims: 

1.1. Claim 1 . (Currently Amended) A method of securing a device having data 
communication capability, comprising dynamically detecting a control connection, 
which originates from said device, noticing negotiation of a related connection 
within said control connection, said negotiation comprising at least defining a port 
of the device for said related connection, checking if relationship between said 
port of the device and the control connection fulfills predefined criteria, and 
conditionally blocking said related connection, if said port of the device does not 
fulfill said predefined criteria^ 
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wherein said predefined criteria requires that said port of the device is opened 
within a predefined time window in relation to noticing negotiation of a related 
connection within said control connection, and wherein said predefined criteria 
requires that said control connection and said port of the device are opened by 
the same process family . 

1.2. Claims 2-3 cancelled. 

1 .3. Claim 6. (Currently Amended) A device having data communication 
capability and comprising a module, which is configured to dynamically detect a 
control connection, which originates from said device, notice negotiation of a 
related connection within said control connection, said negotiation comprising at 
least defining a port of the device for said related connection, check if 
relationship between said port of the device and the control connection fulfills 
predefined criteria, and conditionally block said related connection, if said port of 
the device does not fulfill said predefined criteria i 

wherein said predefined criteria requires that said port of the device is opened 
within a predefined time window in relation to noticing negotiation of a related 
connection within said control connection, and wherein said predefined criteria 
requires that said control connection and said port of the device are opened bv 
the same process family . 
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1.4. Claim 8. (Currently Amended) A computer readable storage medium 
comprising a computer program that carries out steps procedure which 
comprises dynamically detecting a control connection, which originates from said 
device, noticing negotiation of a related connection within said control 
connection, said negotiation comprising at least defining a port of the device for 
said related connection, checking if relationship between said port of the device 
and the control connection fulfills predefined criteria, and conditionally blocking 
said related connection, if said port of the device does not fulfill said predefined 
criteria., 

wherein said predefined criteria requires that said port of the device is opened 
within a predefined time window in relation to noticing negotiation of a related 
connection within said control connection, and wherein said predefined criteria 
requires that said control connection and said port of the device are opened by 
the same process family . 

1.5. Claims 9-10 cancelled. 

1 .6. Claim 13. (Currently Amended) A computer readable storage medium, 
comprising a computer program that carries out a personal firewall process which 
further includes dynamically detecting a control connection, which originates from 
said device, noticing negotiation of a related connection within said control 
connection, said negotiation comprising at least defining a port of the device for 
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said related connection, checking if relationship between said port of the device 
and the control connection fulfills predefined criteria, and conditionally blocking 
said related connection, if said port of the device does not fulfill said predefined 
criteria^ 

wherein said predefined criteria requires that said port of the device is opened 
within a predefined time window in relation to noticing negotiation of a related 
connection within said control connection, and wherein said predefined criteria 
requires that said control connection and said port of the device are opened by 
the same process family . 

1 .7. Claim 14. (Currently Amended) A device having data communication 
capability and comprising a first detector dynamically detecting a control 
connection, which originates from said device, a second detector detecting a 
negotiation of a related connection within said control connection, said 
negotiation comprising at least defining a port of the device for said related 
connection, a controller checking if relationship between said port of the device 
and the control connection fulfills predefined criteria, and said controller 
conditionally blocking said related connection, if said port of the device does not 
fulfill said predefined criteria, 

wherein said predefined criteria requires that said port of the device is opened 
within a predefined time window in relation to noticing negotiation of a related 
connection within said control connection, and wherein said predefined criteria 
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requires that said control connection and said port of the device are opened by 
the same process family . 

In the Specification: 

1 .8. Please add the following at the end of paragraph [0032]: 
" The embodiments of the invention can be implemented using different 
mechanisms known by the one skilled in art, for example, a computer readable 
storage medium, known as part of a computer hardware ". 



/Matthew Heneghan/ 

Primary Examiner, Art Unit 2139 
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2. The text of those sections of Title 35, U.S. Code not included in this section can 
be found in the prior office action. 

3. Claims 1, 6, 8, 13, and 14 have been amended by the applicant. 

4. Claims 1 , 4-8, 11-15, now re-numbered as claims 1 -1 1 are pending. 

Response to Arguments 

5. Applicant's arguments in the action filed 2/21/2008, has been found persuasive in 
light of the limitations of the amended claims, and agreement reached on the 
telephone interview conducted 2/27/2008 (please see the attached Interview 
Summary). 

Allowable Subject Matter 

6. Amended claims 1, 4-8, 11-15, now re-numbered as claims 1-1 1 are allowed. 



Conclusion 
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7. Any comments considered necessary by the applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submission should be clearly labeled "comments on 
statement of reasons for allowance." 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Farid Homayounmehr whose telephone number is 571 
272 3739. The examiner can normally be reached on 9 hrs Mon-Fri, off Monday 
biweekly. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kristine Kincaid can be reached on (571) 272-4063. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Farid Homayounmehr 
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/Matthew Heneghan/ 

Primary Examiner, Art Unit 2139 
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